Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 2+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 45. Missed: 27. Coverage: 62.5%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (48.68% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1115 – open clipboard
• T1134 – modify access privileges
• T1112 – delete registry value
• T1010 – enumerate gui resources
• T1547.009 – create shortcut via IShellLink
• T1115 – read clipboard data
• T1083 – check if file exists
• T1033 – get session user name
• T1087 – get session user name
• T1082 – get disk size
• T1115 – list drag and drop files
• T1083 – enumerate files on Windows
• T1016 – get socket status
• T1112 – delete registry key
• T1082 – get disk information
• T1082 – get system information on Windows
• T1083 – enumerate files recursively
• T1113 – capture screenshot
• T1083 – get common file path
• T1056.001 – log keystrokes
• T1083 – get file version info
• T1056.001 – log keystrokes via polling
• T1134 – acquire debug privileges
• T1129 – link function at runtime on Windows
• T1027 – encode data using XOR
• T1082 – get hostname
• T1082 – get memory capacity
• T1012 – query or enumerate registry key
• T1497.002 – check for unmoving mouse cursor
• T1010 – find graphical window
• T1129 – parse PE header
• T1614.001 – get keyboard layout
• T1564.003 – hide graphical window
• T1222 – set file attributes
• T1082 – get COMSPEC environment variable
• T1059 – compiled with AutoIt
• T1134.001 – impersonate user
• T1529 – shutdown system
• T1105 – download and write a file
• T1027 – encode data using Base64
• T1057 – enumerate processes
• T1518 – enumerate processes
• T1033 – get token membership
• T1082 – query environment variable
• T1012 – query or enumerate registry value
• T1083 – get file size
• T1003 – Harvests information related to installed mail clients
• T1552 – Harvests information related to installed mail clients
• T1552.001 – Harvests information related to installed mail clients
• T1027 – The binary likely contains encrypted or compressed data
• T1027.002 – The binary likely contains encrypted or compressed data
• T1114 – Harvests information related to installed mail clients
• T1005 – Harvests information related to installed mail clients
• T1082 – Checks available memory
• T1071 – Yara detections observed in process dumps, payloads or dropped files
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1071 – The PE file contains an overlay
• T1071 – Looks up the external IP address
• T1106 – Guard pages use detected – possible anti-debugging.
• T1005 – Searches for sensitive browser data
• T1005 – Reads sensitive browser data
• T1005 – Searches for sensitive mail data
• T1005 – Reads sensitive mail data
• T1012 – Query OS Information
• T1012 – Searches for sensitive mail data
• T1012 – Reads sensitive mail data
• T1012 – Possibly does reconnaissance
• T1016 – Reads network adapter information
• T1016 – Checks external IP address
• T1016 – Combination of other detections shows configuration discovery
• T1027.002 – Creates a page with write and execute permissions
• T1027.002 – Resolves API functions dynamically
• T1047 – Collects hardware properties
• T1047 – Queries OS version via WMI
• T1055 – Writes into the memory of another process
• T1055 – Modifies control flow of another process
• T1057 – Enumerates running processes
• T1071.004 – Performs DNS request
• T1082 – Query OS Information
• T1082 – Enumerates running processes
• T1082 – Collects hardware properties
• T1082 – Queries OS version via WMI
• T1082 – Combination of other detections shows configuration discovery
• T1083 – Searches for sensitive browser data
• T1083 – Possibly does reconnaissance
• T1095 – Connects to remote host
• T1106 – Makes direct system call to possibly evade hooking based monitoring
• T1119 – Searches for sensitive browser data
• T1119 – Reads sensitive browser data
• T1119 – Searches for sensitive mail data
• T1119 – Reads sensitive mail data
• T1134 – Enables process privileges
• T1497.001 – Tries to detect application sandbox
• T1552.001 – Searches for sensitive browser data
• T1552.002 – Searches for sensitive mail data
• T1552.002 – Reads sensitive mail data
• T1555.003 – Reads sensitive browser data
• T1564.003 – Creates process with hidden window
• T1622 – Tries to detect debugger
• T1047 – Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
• T1047 – Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
• T1047 – Queries BIOS Information (via WMI, Win32_Bios)
• T1047 – Queries process information (via WMI, Win32_Process)
• T1055 – May try to detect the Windows Explorer process (often used for injection)
• T1055 – Maps a DLL or memory area into another process
• T1055 – Writes to foreign memory regions
• T1497 – Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
• T1497 – Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
• T1497 – Checks if the current process is being debugged
• T1562.001 – Creates guard pages, often used to prevent reverse engineering and debugging
• T1003 – Tries to harvest and steal browser information (history, passwords, etc)
• T1518.001 – Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
• T1518.001 – Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
• T1518.001 – Switches to a customs stack to bypass stack traces
• T1518.001 – Checks if the current process is being debugged
• T1518.001 – Check if machine is in data center or colocation facility
• T1057 – May try to detect the Windows Explorer process (often used for injection)
• T1016 – Checks the online ip address of the machine
• T1083 – Reads ini files
• T1082 – Checks if Microsoft Office is installed
• T1082 – Switches to a customs stack to bypass stack traces
• T1082 – Queries the cryptographic machine GUID
• T1082 – Queries BIOS Information (via WMI, Win32_Bios)
• T1082 – Queries process information (via WMI, Win32_Process)
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1114 – Tries to search for mail accounts
• T1005 – Tries to harvest and steal browser information (history, passwords, etc)
• T1105 – Downloads files from webservers via HTTP
• T1095 – Downloads files from webservers via HTTP
• T1071 – Downloads files from webservers via HTTP

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.